Mobile data connectivity using a cellular system is currently accomplished through a specialized protocol known as Mobile Internet Protocol (IP). At the time of this writing, Internet Protocol has been advanced to a sixth version and this sixth version includes a mobile extension (i.e. Mobile IPv6). As currently defined, a mobile node is always expected to be addressable using its home address. While a mobile node is in a home region (i.e. a home cell), the mobile node is addressed according to its home address, which is stored in a special link called a “home link”. As such, the home link for the mobile node amounts to an internet protocol address that is valid while the mobile node is in its home cell. As a mobile node travels beyond its home cell, it invariably enters a foreign cell. While in this foreign cell, a different link, called a “care-of” link, is used to store an address which can be used to direct data to the mobile node while it is in the foreign cell. Typically, a mobile node receives a care-of address from a foreign agent; i.e. a router or other device responsible for managing addresses in a network included in the foreign cell.
Mobile communication mechanisms generally provide some means for correlating a home link with a care-of link. As specified by the Mobile Internet Protocol, this association means is known as a “binding”. Accordingly, it is this binding that is used to forward data to a mobile node when it is in a foreign cell. Management of the binding of a mobile node occurs through a process wherein a mobile node communicates with a device known as a “home agent”. The home agent is typically embodied as a router or other packet forwarding apparatus. The home agent receives a “binding update” message from the mobile node as the mobile node travels from one foreign cell to another. The home agent creates a binding according to the binding update message(s) it receives from the mobile node. In response, the home agent directs a “binding acknowledgment” message back to the mobile node. This indicates to the mobile node that the home agent has received a binding update message and has updated an association between the home-link and the care-of link.
In order for a mobile node to communicate with its home agent, it needs to determine the identity of the home agent. In some cases, the mobile node simply waits until it receives an advertisement message from the home agent. Alternatively, the mobile node dispatches a solicitation message. The solicitation message is eventually conveyed to the home agent. In response, the home agent will identify itself to the mobile node. Because a home agent can be attached to a dynamically reconfigurable network included in a home cell, the mobile node may optionally need to discover a network prefix for the home agent. The network prefix, or simply prefix can then be used to communicate with the home agent. Once a binding is established, additional messages are conveyed from the mobile node to the home agent in order to test the data path. This process is known as return routability signaling and is often used in optimizing the routing between a mobile node and a correspondent node. Return routability signaling typically tests the addressability of a mobile node by using both the home address and the care-of address of the mobile node. A correspondent node is another node with which the mobile node may communicate using a cellular data network.
A practical cellular data system uses this or some other similar type of binding mechanism so that a mobile node can be addressed irrespective of its actual physical location. As such, when a data packet is directed to the mobile node using the home link (i.e. the mobile node's home address), the data packet is forwarded either to the home address or to a foreign address according to any binding maintained by the home agent. When there is no binding, the data packet is addressed according to the address stored in the home-link. If there is such a binding, the data packet is re-routed according to the address stored in the care-of link. Once the path between a mobile node and its home agent is established, actual payload data can be communicated between the two.
As security concerns continue to rise, the establishment of bindings in a mobile networking environment was found to be susceptible to attack. As a result, the messaging between a mobile node and a home agent is now specified to include security features. For example, security for signals including at least one of a binding update message, a binding acknowledgement, a return routability signal, a prefix discover message and actual payload data can be provided by any suitable network security protocol. For example, Mobile Internet Protocol v6 incorporates provisions for security that rely on the Internet Protocol Security protocol, a.k.a. “IPsec”.
As can be appreciated from this brief introduction to mobile network addressing, communication between a mobile node and a home agent must be provided in order to enable the binding mechanism used to correlate a home link with a care-of link. The determination of a network prefix for the home agent and messages associated with return routability signaling must also be supported by some form of data communications. According to the Mobile Internet Protocol, the messaging between a mobile node and a home agent is carried by data packets.
Data packets can be propagated by a network in two different modes; transport and tunneling. When a data packet is propagated in transport mode, it is directed using a source address and a destination address included in the data packet itself. When a data packet is carried by a “tunnel”, the ordinary addressing scheme provided by the network is circumvented. For example, when a data packet is directed from a home agent to a mobile node, the data packet is encapsulated in a new data packet at the same level in the protocol. This new packet is called a tunneling packet. The destination address in the resultant data packet reflects the address stored in the care-of link. Once the data packet arrives in the foreign network, the original data packet, which still carries the home address of a mobile node as a destination address, is extracted from the tunneling packet and directed to the mobile node. When a data packet is directed from the mobile node back to the home agent, it must be encapsulated in a tunneling packet and directed in a like manner back to the home agent.
Until now, the signaling that occurred between a mobile node and a home agent was conveyed using two types of security protocols; IPsec transport and IPsec tunnel. Binding updates and acknowledgements and prefix discovery messages have traditionally been propagated using IPSec transport mode. Return routability signals and payload data have traditionally been propagated using IPSec tunnel mode. Using the IPSec protocol, each data path requires a distinct security policy database (SPD) and a corresponding security association (SA). Accordingly, four SPDs and four SAs are required to propagate the corresponding signal types, i.e. (1) Binding updates and acknowledgements; (2) prefix discovery messages; (3) return routability signals; and (4) payload data.
A security policy database includes information that describes the types of security features that should be used for each data path. This means that different security features can be applied to binding updates, prefix discovery messages and the other types of signals and data communicated between a mobile node and a home agent. Each corresponding security association is used to manage encryption features, such as the storage of keys, used by a particular security policy database.
There is a significant cost in terms of network bandwidth, processor performance and platform memory that needs to be paid for establishing an IPSec data path, either in transport mode or in tunnel mode. For example, each security association requires significant coordination between a mobile node and a home agent as encryption and decryption keys are passed back and forth. Then, the encryption keys need to be maintained (i.e. stored) in a processing platform (e.g. a mobile node or a home agent). Given that a mobile node can be a limited resource device, it is difficult to justify the added overhead associated with secure establishment of bindings and secure transmission of data.